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UNITED STATES DISTRICT COURT 
NORTHERN DISTRICT OF CALIFORNIA 


J. DOE 1, et al., Case No. 22-cv-06823-JST 
Plaintiffs, 
ORDER GRANTING IN PART AND 
Vv. DENYING IN PART MOTIONS TO 
DISMISS 


GITHUB, INC., et al., 
Re: ECF Nos. 50, 53 
Defendants. 


Before the Court are motions to dismiss filed by Defendants GitHub, Inc. and Microsoft 
Corporation, ECF No. 50; and Defendants OpenAI, Inc., OpenAI, L.P., OpenAI GP, L.L.C., 
OpenAI Startup Fund GP I, L.L.C., OpenAI Startup Fund I, L.P., and OpenAI Startup Fund 
Management, LLC (collectively “OpenAI Defendants”), ECF No. 53. Court will grant the 
motions in part and deny them in part. 

I. BACKGROUND 

Plaintiffs are software developers who challenge Defendants’ development and operation 
of Copilot and Codex, two artificial intelligence-based coding tools.’ For the purposes of the 
present motions, the Court accepts as true the following facts in the operative complaint.” 

GitHub, which was acquired by Microsoft in 2018, is the largest internet hosting service 


for software projects stored in Git, a widely used open-source version control system for managing 


' Plaintiffs define “artificial intelligence” (“AI”) as “a computer program that algorithmically 
simulates human reasoning or inference, often using statistical methods.” Compl. §] 2. 


? By stipulation and order, ECF No. 47, the operative complaint in the consolidated case is that 
filed in Doe 3 et al. v. GitHub, Inc. et al., No. 22-cv-7074-JST, ECF No. 1. All references to the 
complaint in this order refer to the operative complaint in the consolidated case. 
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software source code. Using GitHub permits software developers or programmers to collaborate 
on projects stored in repositories. Repositories may be private or public; anyone can view and 
access code stored in public repositories. 

All code uploaded to GitHub is subject to the GitHub Terms of Service, which provide that 
users retain ownership of any content they upload to GitHub, but grant GitHub the “right to store, 
archive, parse, and display [the content], and make incidental copies, as necessary to provide the 
Service, including improving the Service over time.” No. 22-cv-7074-JST, ECF No. 1-2 at 27. 
This “includes the right to do things like copy [the code] to our database and make backups; show 
it to you and other users; parse it into a search index or otherwise analyze it on our servers; [and] 
share it with other users.” Jd. at 27-28. Further, the Terms of Service provide that users who set 
their repositories to be viewed publicly “grant each User of GitHub a nonexclusive, worldwide 
license to use, display, and perform [the content] through the GitHub Service and to reproduce 
[the content] solely on GitHub as permitted through GitHub’s functionality.” Jd. at 28. 

Without Al-based assistance, programmers generally write code “both by originating code 
from the writer’s own knowledge of how to write code as well as by finding pre-written portions 
of code that—under the terms of the applicable license—may be incorporated into the coding 
project.” Compl. { 78. Plaintiffs have each published licensed materials in which they hold a 
copyright interest to public repositories on GitHub. When creating a new repository, a GitHub 
user may “select[] one of thirteen licenses from a dropdown menu to apply to the contents of that 
repository.” Jd. [34 n.4. Two of the suggested licenses waive copyrights and related rights. The 
remaining eleven suggested licenses* require that any derivative work or copy of the licensed work 
include attribution to the owner, inclusion of a copyright notice, and inclusion of the license terms. 


Each Plaintiff published code to a public repository on GitHub under one of the eleven suggested 


> These eleven licenses are (1) Apache License 2.0; (2) GNU General Public License version 3 
(“GPL-3.0”); (3) MIT License; (4) The 2-Clause BSD License (“BSD 2”); (5) The 3-Clause BSD 
License (“BSD 3”); (6) Boost Software License; (7) Eclipse Public License 2.0; (8) GNU Affero 
General Public License version 3 (““AGPL-3.0”); GNU General Public License version 2 (“GPL 
2”); (10) GNU Lesser General Public License version 2.1 (“LGPL-2.1”’); and (11) Mozilla Public 
License 2.0. Compl. { 34 n.4. 
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licenses that include these three requirements. 

In June 2021, GitHub and OpenAI released Copilot, an AI-based program that can “assist 
software coders by providing or filling in blocks of code using AI.” Jd. [ 8. In August 2021, 
OpenAI released Codex, an AI-based program “which converts natural language into code and is 
integrated into Copilot.” Id. [ 9. Codex is integrated into Copilot: “GitHub Copilot uses the 
OpenAI Codex to suggest code and entire functions in real-time, right from your editor.” Id. [ 47 
(quoting GitHub website). GitHub users pay $10 per month or $100 per year for access to 
Copilot. Id. J 8. 

Codex and Copilot employ machine learning, “a subset of AI in which the behavior of the 
program is derived from studying a corpus of material called training data.” Jd. { 2. Using this 
data, “through a complex probabilistic process, [these programs] predict what the most likely 
solution to a given prompt a user would input is.” Jd. | 79. Codex and Copilot were trained on 
“billions of lines” of publicly available code, including code from public GitHub repositories. Jd. 
{i 82-83. 

Despite the fact that much of the code in public GitHub repositories is subject to open- 
source licenses which restrict its use, id. | 20, Codex and Copilot “were not programmed to treat 
attribution, copyright notices, and license terms as legally essential,” id. {| 80. Copilot reproduces 
licensed code used in training data as output with missing or incorrect attribution, copyright 
notices, and license terms. Id. {§[ 56, 71, 74, 87-89. This violates the open-source licenses of 
“tens of thousands—possibly millions—of software developers.” Jd. { 140. Plaintiffs additionally 


2 66 


allege that Defendants improperly used Plaintiffs’ “sensitive personal data” by incorporating the 
data into Copilot and therefore selling and exposing it to third parties. Jd. {| 225-39. 
Plaintiffs filed multiple cases against Defendants, which were subsequently consolidated. 


ECF No. 47. Plaintiffs, on behalf of themselves and two putative classes,* plead twelve counts 


* The “Injunctive Relief Class” and “Damages Class” are each defined as: “All persons or entities 
domiciled in the United States that[] (1) owned an interest in at least one [U.S.] copyright in any 
work; (2) offered that work under one of GitHub’s Suggested Licenses; and (3) stored Licensed 
Materials in any public GitHub repositories at any time between January 1, 2015 and the present 
(the ‘Class Period’).” Compl. 4 34 (footnote omitted). 
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against Defendants: (1) violation of the Digital Millennium Copyright Act (“DMCA”), 17 U.S.C. 
§§ 1201-05; (2) common law breach of open-source licenses; (3) common law tortious 
interference in a contractual relationship; (4) common law fraud; (5) false designation of origin in 
violation of the Lanham Act, 15 U.S.C. § 1125; (6) unjust enrichment in violation of Cal. Bus. & 
Prof. Code §§ 17200, et seq., and the common law; (7) unfair competition in violation of the 
Lanham Act, 15 U.S.C. § 1125; Cal. Bus. & Prof. Code §§ 17200, et seg., and the common law; 
(8) breach of contract for violation of the GitHub Privacy Policy and Terms of Service; (9) 
violation of the California Consumer Privacy Act (“CCPA”); (10) common law negligence; (11) 
common law civil conspiracy; and (12) declaratory relief under 28 U.S.C. § 2201(a) and Cal. Code 
Civ. Proc. § 1060.° Defendants now move to dismiss the complaint. ECF Nos. 50, 53. 

Il. JURISDICTION 

The Court has jurisdiction over Plaintiffs’ federal claims under 28 U.S.C. § 1331 and 
supplemental jurisdiction over Plaintiffs’ state law claims under 28 U.S.C. § 1367. 

I. LEGAL STANDARD 

A. Rule 12(b)(1) 

“Article III of the Constitution confines the federal judicial power to the resolution of 
‘Cases’ and ‘Controversies.’” TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2203 (2021). “For 
there to be a case or controversy under Article III, the plaintiff must have a ‘personal stake’ in the 
case—in other words, standing.” /d. (quoting Raines v. Byrd, 521 U.S. 811, 819 (1997)). A 
defendant may attack a plaintiff's assertion of jurisdiction by moving to dismiss under Rule 


12(b)(1) of the Federal Rules of Civil Procedure. Cetacean Cmty. v. Bush, 386 F.3d 1169, 1174 


> While Plaintiffs plead several common law tort claims, they do not identify the state law which 
applies to each claim. “[D]ue to variances among state laws, failure to allege which state law 
governs a common law claim is grounds for dismissal.” In re Nexus 6P Prods. Liab. Litig., 293 F. 
Supp. 3d 888, 933 (N.D. Cal. 2018) (quoting Romero v. Flowers Bakeries, LLC, No. 14-cv-05189- 
BLF, 2016 WL 469370, at *12 (N.D. Cal. Feb. 8, 2016)). With respect to the state law claims in 
any future amended complaint, Plaintiffs shall identify the state under whose law the claim is 
brought. When claims which share a legal theory are brought under multiple laws (for example, a 
federal statute, a state statute, and common law, such as Plaintiffs’ claim for unfair competition), 
Plaintiffs shall state each claim as a separate count. For the purposes of deciding the present 
motion to dismiss, the Court interprets the complaint as asserting the common law claims of 
Counts 2, 3, 4, 6,7, 10, and 11 under California law. 
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(9th Cir. 2004); see also Maya v. Centex Corp., 658 F.3d 1060, 1067 (9th Cir. 2011) (“[L]ack of 
Article HI standing requires dismissal for lack of subject matter jurisdiction under Federal Rule of 
Civil Procedure 12(b)(1).”). 

“A Rule 12(b)(1) jurisdictional attack may be facial or factual.” Safe Air for Everyone v. 
Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004). “In a facial attack, the challenger asserts that the 
allegations contained in a complaint are insufficient on their face to invoke federal jurisdiction.” 
Id. Where, as here, a defendant makes a facial attack, the court assumes that the complaint’s 
allegations are true and draws all reasonable inferences in the plaintiff’s favor. Wolfe v. 
Strankman, 392 F.3d 358, 362 (9th Cir. 2004). 

B. Rule 12(b)(6) 

“Dismissal under [Federal Rule of Civil Procedure] 12(b)(6) is appropriate only where the 
complaint lacks a cognizable legal theory or sufficient facts to support a cognizable legal theory.” 
Mendiondo vy. Centinela Hosp. Med. Ctr., 521 F.3d 1097, 1104 (9th Cir. 2008). A complaint must 
contain “a short and plain statement of the claim showing that the pleader is entitled to relief.” 
Fed. R. Civ. P. 8(a)(2). Facts pleaded by a plaintiff “must be enough to raise a right to relief 
above the speculative level.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). 

“To survive a motion to dismiss, a complaint must contain sufficient factual matter, 
accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 
662, 678 (2009) (quoting Twombly, 550 U.S. at 570)). “A claim has facial plausibility when the 
plaintiff pleads factual content that allows the court to draw the reasonable inference that the 
defendant is liable for the misconduct alleged.” Jd. In determining whether a plaintiff has met this 
plausibility standard, the Court must “accept all factual allegations in the complaint as true and 
construe the pleadings in the light most favorable to the nonmoving party.” Knievel v. ESPN, 393 
F.3d 1068, 1072 (9th Cir. 2005). 

C. Leave to Amend 

Leave to amend a complaint “shall be freely given when justice so requires.” Fed. R. Civ. 
P. 15(a)(2). The decision of whether to grant leave to amend is “within the discretion of the 


district court, which may deny leave due to ‘undue delay, bad faith or dilatory motive on the part 
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of the movant, repeated failure to cure deficiencies by amendments previously allowed, undue 
prejudice to the opposing party by virtue of allowance of the amendment, and futility of 
amendment.’” Leadsinger, Inc. vy. BMG Music Pub., 512 F.3d 522, 532 (9th Cir. 2008) (quoting 
Foman v. Davis, 371 U.S. 178, 182 (1962)). 

IV. DISCUSSION 

A. Article III Standing 

Defendants argue that Plaintiffs lack Article III standing to assert their claims and that the 
Court therefore lacks subject-matter jurisdiction over this action.® 

“[T]o establish standing, a plaintiff must show (1) that he suffered an injury in fact that is 
concrete, particularized, and actual or imminent; (ii) that the injury was likely caused by the 
defendant, and (iii) that the injury would likely be redressed by judicial relief.” TransUnion, 141 
S. Ct. at 2203. “The party invoking federal jurisdiction bears the burden of establishing these 
elements.” Lujan v. Defenders of Wildlife, 504 U.S. 555, 561 (1992). “Where, as here, a case is at 
the pleading stage, the plaintiff must ‘clearly . . . allege facts demonstrating’ each element.” 
Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016) (quoting Warth v. Seldin, 422 U.S. 490, 518 
(1975)). 

“A plaintiff must demonstrate constitutional standing separately for each form of relief 
requested.” Davidson v. Kimberly-Clark, 889 F.3 956, 969 (9th Cir. 2018). In a putative class 
action, named plaintiffs “must allege and show that they personally have been injured, not that 
injury has been suffered by other, unidentified members of the class to which they belong and 
which they purport to represent.” Warth, 422 U.S. at 502. 


Plaintiffs advance two main theories of harm. One theory is that Defendants have shared, 


° Both parties impermissibly incorporate substantive material by reference across their briefs. 
“The incorporation of substantive material by reference is not sanctioned by the federal rules.” 
Swanson v. U.S. Forest Serv., 87 F.3d 339, 345 (9th Cir. 1996). In the future, all arguments the 
parties seek to make must be raised in the briefing on a particular motion. See Woolfson v. Conn 
Appliances, Inc., No. 21-cv-07833-MMC, 2022 WL 3139522, at *6 (N.D. Cal. Aug. 5, 2022) 
(declining to consider substantive arguments purportedly incorporated by reference); Williams v. 
Cnty. of Alameda, 26 F. Supp. 3d 925, 947 (N.D. Cal. 2014) (“[T]he Court will not consider the 
arguments that Plaintiff improperly seeks to incorporate by reference. This Court only considers 
arguments that are specifically and distinctively raised by the parties in their briefs.”). 
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sold, and exposed and will continue to share, sell, and expose Plaintiffs’ personal information, 
harming Plaintiffs’ rights to privacy and the protection of their personal data. The second is that 
Defendants’ use of licensed code as training data for Codex and Copilot harms Plaintiffs’ property 
interests in the licensed code because Copilot already has or likely will reproduce Plaintiffs’ code 
in violation of those licenses. 

1; Injury to Privacy Rights 

Defendants argue that Plaintiffs fail to plausibly allege any disclosure of personal 
information, and therefore fail to allege an actual or imminent injury sufficient to confer standing. 
In the complaint, Plaintiffs do not identify the specific sensitive or private information at issue. 
Plaintiffs therefore do not allege facts sufficient for the Court to infer that Plaintiffs’ privacy 
interests are implicated by the alleged misuse of such information. See Ji v. Naver Corp., No. 21- 
cv-05143-HSG, 2022 WL 4624898, at *7 (N.D. Cal. Sept. 30, 2022) (dismissing privacy-based 
claim for lack of standing where plaintiffs “have not alleged enough facts to show that the 
[personal data at issue] are the type of information that could give rise to a privacy injury”); 1.C. v. 
Zynga, Inc., 600 F. Supp. 3d 1034, 1049 (N.D. Cal. Apr. 29, 2022) (evaluating whether privacy 
interests were implicated by allegedly disclosed personal information to determine whether 
plaintiffs had standing). 

Plaintiffs have not met their burden to allege facts demonstrating an injury-in-fact 
sufficient to confer standing for their privacy-based claims. Plaintiffs’ claims for breach of the 
GitHub Privacy Policy and Terms of Service, violation of the CCPA, and negligence are 
dismissed with leave to amend. 

2. Injury to Property Rights 

Defendants argue that Plaintiffs do not identify any instance of Copilot reproducing 
Plaintiffs’ licensed code and therefore fail to plead a particularized injury sufficient to confer 
standing. 

“For an injury to be ‘particularized,’ it ‘must affect the plaintiff in a personal and 
individual way.’” Spokeo, 578 U.S. at 339 (quoting Lujan, 504 U.S. at 560 n.1). “[A]t an 


irreducible minimum, Art. III requires the party who invokes the court’s authority to ‘show that he 
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personally has suffered some actual or threatened injury.’”” Valley Forge Christian Coll. v. Ams. 
United for Separation of Church and State, Inc., 454 U.S. 464, 472 (1982) (quoting Gladstone 
Realtors v. Village of Bellwood, 441 U.S. 91, 99 (1979)). 

Plaintiffs argue that they “have alleged the requisite particularized injury” because they 
“allege that Defendants have violated provisions of [the] open-source licenses” under which 
Plaintiffs published their code. ECF No. 67 at 14. In the complaint, Plaintiffs allege that 
Defendants violate those licenses because Copilot reproduces Plaintiffs’ code as output with 
missing or incorrect attribution, copyright notices, and license terms.’ However, while Plaintiffs 
identify several instances in which Copilot’s output matched licensed code written by a Github 
user, Compl. {| 56, 71, 74, 87-89, none of these instances involve licensed code published to 
GitHub by Plaintiffs. Because Plaintiffs do not allege that they themselves have suffered the 
injury they describe, they do not have standing to seek retrospective relief for that injury.® 

Plaintiffs also argue that they “also allege an imminent and significant harm—now that 
their software code is part of the training data... , [it] can be output at any time without the 
legally necessary notices and attribution, leading to increased and imminent risk of 
misappropriation.” ECF No. 67 at 15. To the extent that Plaintiffs allege an injury based on the 
increased risk of misappropriation of their own licensed code, that injury is sufficiently 
particularized. However, an increased risk of future harm alone is not sufficiently concrete to 


confer standing for damages. TransUnion, 141 S. Ct. at 2210-11 (finding “persuasive” argument 


Tn opposition, Plaintiffs suggest they were also injured by Defendants’ use of Plaintiffs’ licensed 
code as training data for Codex and Copilot. ECF No. 66 at 12, 21. But Plaintiffs’ complaint does 
not describe such an injury. In the complaint, Plaintiffs allege that “Defendants had access to but 
were not licensed by Plaintiffs . . . to train any . . . functional prediction engine using the Licensed 
Materials.” Compl. {| 149; see also id. {37 (describing one question common to the putative class 
as “[w]hether Defendants violated the Licenses governing use of the Licensed Materials by using 
them to train Copilot”). However, Plaintiffs do not actually allege that Defendants’ use of 
licensed code to train Codex and Copilot constituted a breach of the open-source licenses at issue. 
See id. [| 172-87 (alleging that Defendants breached the licenses by failing to provide attribution 
in output, failing to provide copyright notices in output, and failing to identify applicable licenses 
and the text of those licenses in output). Because Plaintiffs do not allege they were injured by 
Defendants’ use of licensed code as training data, the Court does not address whether such an 
injury is sufficient to confer standing. 


8 This problem is related to redressability: Plaintiffs allege no injury redressable by the monetary 
damages they seek. 
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that, “in a suit for damages, the mere risk of future harm . . . cannot qualify as a concrete harm... 
unless the exposure to the risk of future harm itself causes a separate concrete harm’) (emphasis 
in original); id. at 2213 (holding that “the risk of future harm on its own does not support Article 
III standing for the plaintiffs’ damages claims’). Plaintiffs do not allege any additional, concrete 
harm associated with this increased risk of misappropriation. Thus, an increased risk of 
misappropriation cannot provide standing for Plaintiffs’ damages claims. 

Finally, Plaintiffs argue that, “[g]iven the number of times users may use Copilot, it is a 
virtual certainty [that] any particular plaintiff's code will be displayed either with copyright 
notices removed or in violation of Plaintiffs’ open-source licenses for profit.” ECF No. 67 at 15. 
Though this does not support standing for retrospective damages — for which, as discussed above, 
Plaintiffs must allege that they have suffered a qualifying injury-in-fact that has actually occurred 
to them — it may support standing for injunctive relief. 

“[A] person exposed to a risk of future harm may pursue forward-looking, injunctive relief 
to prevent the harm from occurring, at least so long as the risk of harm is sufficiently imminent 
and substantial.” TransUnion, 141 S. Ct. at 2210. “An allegation of future injury may suffice if 
the threatened injury is ‘certainly impending,’ or there is a ‘substantial risk that the harm will 
occur.” Susan B. Anthony List v. Driehaus, 573 U.S. 149, 158 (2014) (quoting Clapper v. 
Amnesty Int’l USA, 568 U.S. 414 n.5 (2013)). A substantial risk means there is a “realistic danger 
of sustaining a direct injury.” Pennell v. City of San Jose, 485 U.S. 1, 8 (1988) (quoting Babbitt v. 
United Farm Workers Nat’l Union, 442 U.S. 289, 298 (1979)). 

Plaintiffs plausibly allege that there is at least a substantial risk that Defendants’ programs 
will reproduce Plaintiffs’ licensed code as output. Plaintiffs allege that both Codex and Copilot 
were trained on data that included all public GitHub repositories. Plaintiffs further allege that the 
programs reproduce well-known code in response to related prompts and offer several concrete 
examples of such reproduction. Finally, Plaintiffs allege that GitHub’s own internal research 
shows that Copilot reproduces code from training data “about 1% of the time.” Compl. {ff 56, 71, 
74, 87-90. Plaintiffs thus plausibly allege that, absent injunctive relief, there is a realistic danger 


that Codex or Copilot will reproduce Plaintiffs’ licensed code as output. Plaintiffs further allege 
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that Defendants have modified Copilot to ensure that it no longer reproduces license text, 
attribution, and copyright notices. Taking the facts of the complaint as true and construing all 
inferences in the Plaintiffs’ favor, the Court can reasonably infer that, should Plaintiffs’ code be 
reproduced as output, it will be reproduced in a manner that violates the open-source licenses 
under which Plaintiffs published their code.” 

While Plaintiffs have failed to establish an injury-in-fact sufficient to confer standing for 
their claims for damages based on injury to property rights, they have standing to pursue 
injunctive relief on such claims. 

B. Proceeding Pseudonymously 

Defendants argue that the complaint should be dismissed because Plaintiffs are not entitled 
to proceed under fictitious names.'° 

“The normal presumption in litigation is that parties must use their real names.” Doe v. 
Kamehameha Schs./Bernice Pauahi Bishop Est., 596 F.3d 1036, 1042 (9th Cir. 2010). Parties 
may proceed pseudonymously only “in the ‘unusual case’ when nondisclosure of the party’s 
identity ‘is necessary . . . to protect a person from harassment, injury, ridicule or personal 
embarrassment.” Does I Thru XXIII v. Advanced Textile Corp., 214 F.3d 1058, 1067-68 (9th Cir. 
2000) (alteration in original) (quoting United States v. Doe, 655 F.2d 920, 922 n.1 (9th Cir. 
1981)). 

Threats of physical harm “present[] the paradigmatic case for allowing anonymity.” 


Kamehameha, 596 F.3d at 1043. Where a party seeks to proceed pseudonymously on the basis of 


° Defendants argue that Plaintiffs must also allege facts regarding the type of code they published, 
what problem that code solves, how frequently that code might appear on GitHub, and how likely 
it is that a user would enter a prompt that would generate a match to that code. ECF No. 50 at 16. 
Defendants suggest that, absent such facts, Plaintiffs’ alleged injury is too “conjectural or 
hypothetical” to confer standing. Jd. (quoting Lujan, 504 U.S. at 550). Defendants ask too much 
of Plaintiffs at the pleading stage. Such facts might help Defendants—the only parties with 
knowledge of how Copilot and Codex were designed and operate—understand whether Plaintiffs’ 
alleged injury has already occurred or how soon it is likely to occur. However, taking the facts in 
the complaint as true, and construing all inferences in Plaintiffs’ favor, their alleged future injury 
is neither conjectural nor hypothetical: their licensed code was used to train these programs and 
there is presently a realistic danger that the code will be reproduced as output. 


‘0 Because the caselaw uses “pseudonymous” and “anonymous” interchangeably, this Court does 
so as well. 
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retaliatory harm, “a district court must balance five factors: ‘(1) the severity of the threatened 
harm, (2) the reasonableness of the anonymous party’s fears, . . . (3) the anonymous party’s 
vulnerability to such retaliation,’ (4) the prejudice to the opposing party, and (5) the public 
interest.” Id. at 1042 (quoting Advanced Textile, 214 F.3d at 1068). 

Plaintiffs seek to proceed pseudonymously because, “through their counsel, [they] have 
received legitimate and credible threats of physical violence.” ECF No. 67 at 17. Plaintiffs 
highlight three threatening emails sent to counsel prior to the filing of the operative complaint. All 
three emails contain veiled threats wishing death upon Plaintiffs’ counsel on the basis of his 
involvement in this lawsuit. ECF No. 68-1 at 2 (“[I]magine shooting against [AI] .... [G]o kys. . 
.. [K]ill urself.”); ECF No. 68-2 at 2 (“I hope you f*cking die you piece of sh*t. It’s people like 
you why this world sucks so f*cking bad and we can’t have nice things. I literally hope someone 
murder [sic] you. Go f*cking die.””); ECF No. 68-3 at 2 (“[G]o f*cking cry about [G]it[H]ub you 
f*cking piece of sh*t n****r, [I] hope your throat gets cut open and every single family member 
of you [sic] is burnt to death.”). Plaintiffs’ counsel have received “many” such messages. ECF 
No. 67 at 17. Plaintiffs argue they should be permitted to proceed pseudonymously because they 
reasonably fear they will be subject to threats of retaliation and violence if their identities are 
disclosed. 

The first two factors of the balancing test for retaliatory harm — severity of the threatened 
harm and the reasonableness of the fear of such harm — “are intricately related and should be 
addressed together.” Kamehameha, 596 F.3d at 1040. Plaintiffs need not prove the speakers 
“intend to carry out the threatened retaliation,” but rather “that a reasonable person would believe 
that the threat might actually be carried out.” Advanced Textile, 214 F.3d at 1071. “It is in the 
particular purview of the district court to view alleged threats in context and determine what the 


‘reasonable’ person in the plaintiffs’ situation would fear.” Kamehameha, 596 F.3d at 1044. “In 
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context, a plaintiff might reasonably fear a veiled threat of violence.” JId.'! 

The threatened harm in this case — death — is plainly severe. /d. at 1043 (describing threats 
of physical retaliation, including death, as “undoubtedly severe”); Doe v. Steagall, 653 F.2d 180, 
186 (Sth Cir. 1981) (permitting plaintiffs to proceed pseudonymously where they faced “threats of 
violence,” including veiled death threats, “generated by this case”); Doe v. Univ. Acct. Serv., LLC, 
No. 09-CV-01563-BAS-JLB, 2022 WL 623913, at *4 (S.D. Cal. Mar. 3, 2022) (permitting 
plaintiff to proceed pseudonymously where he received death threats). While the threatening 
emails were not sent to Plaintiffs directly, the emails wish death upon Plaintiffs’ counsel on the 
basis of their involvement in this lawsuit. It is reasonable for Plaintiffs to fear that such threats 
might be carried out against them if their identities were to become public. 

GitHub and Microsoft suggest that Plaintiffs’ fear is unreasonable because “the types of 
nasty messages at issue here are a fact of modern life in the era of internet ‘trolls.’” ECF No. 72 at 
19. GitHub and Microsoft do not explain why the rise of internet trolls renders Plaintiffs’ fears of 
harm unreasonable. Cf. United States v. Bagdasarian, 652 F.3d 1113, 1126-27 (9th Cir. 2011) 
(Wardlaw, J., concurring in part) (describing the connection between anonymous internet posts 
and subsequent real-world violence). Sending direct messages containing veiled death threats 
would seem to constitute behavior beyond trolling. See Merriam Webster’s Collegiate Dictionary 
1341 (11th ed. 2003) (defining “troll,” in relevant part, as “to antagonize (others) online by 
posting inflammatory, irrelevant, or offensive comments or content” and “to harass, criticize, or 
antagonize (someone) esp[ecially] by provocatively disparaging or mocking public statements, 
postings, or acts”) (emphasis added). These were not public posts mocking or antagonizing 
Plaintiffs’ counsel, but rather private emails, sent directly to Plaintiffs’ counsel, wishing him and 


his family violent death. Where many individuals take the time to send private, threatening 


'! Of note, the Ninth Circuit has explained that the standard for reasonable fear in this context is 
more permissive than in First Amendment “true threat” cases. Kamehameha, 596 F.3d at 1044 n.6 
(“The First Amendment cases discussing the concept of a ‘true threat’ . . . pose a higher bar to 
finding a reasonable fear. In those cases, one party’s fear of the threat must be weighed against 
the opposing party’s first amendment right to speak freely because the threatened party seeks to 
prevent the other party’s speech.”). 
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emails, it is reasonable to fear that some of those individuals might carry out their threats. The 
Court finds that the first two factors weigh in favor of permitting Plaintiffs to proceed 
pseudonymously. 

Defendants identify no prejudice from Plaintiffs proceeding pseudonymously. The Ninth 
Circuit has explained that, where a defendant does not know the plaintiff's name, “at some later 
point in the proceedings it may be necessary to reveal plaintiffs’ identities to defendants so that 
defendants may refute [their] individualized accusations.” Advanced Textile, 214 F.3d at 1058. 
“But where the defendants know the plaintiffs’ names, ‘anonymity need not, and should not, 
impede either party’s ability to develop its case’ even though it is ‘foreseeable that anonymity 
[will] raise problems for discovery.” Doe I v. Nat’l Collegiate Athletic Assoc., No. 22-cv-01559- 
LB, 2022 WL 3974098, at *2 (N.D. Cal. Aug. 30, 2022) (quoting Jane Roes 1-2 v. SFBSC Mgnmtt., 
LLC, 77 F. Supp. 3d 990, 996 (N.D. Cal. 2015)). Plaintiffs have disclosed their true names to 
Defendants subject to a protective order, so pseudonymity should not impede Defendants’ ability 
to develop their case. Though pseudonymity may pose certain logistical challenges during 
discovery, this case remains at the pleadings stage. See Doe v. County of El Dorado, No. 2:13- 
CV-01433-KJM, 2013 WL 6230342, at *5 (E.D. Cal. Dec. 2, 2013) (explaining that, “at the 
prediscovery stage . . . the court need not yet consider the prejudice defendant will suffer during 
discovery,” as “the relevant prejudice is that which defendant presently suffers as a result of 
plaintiff's anonymity”). Defendants do not articulate any prejudice associated with Plaintiffs 
proceeding pseudonymously at this stage of the litigation, and this Court is not aware of any. 
Therefore, the Court finds that the prejudice factor does not weigh against permitting Plaintiffs to 
proceed pseudonymously at this stage. 

Finally, the public interest factor does not weigh against permitting Plaintiffs to proceed 
pseudonymously. “The normal presumption in litigation . . . that parties must use their real names 
... 18 loosely related to the public’s right to open courts and the right of private individuals to 
confront their accusers.” Kamehameha, 596 F.3d at 1042. Where the plaintiffs’ identities are not 
central to the issues raised by a case, however, the public interest may not be harmed by 


permitting plaintiffs to proceed pseudonymously. See Advanced Textile , 214 F.3d at 1072 
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(reversing denial of anonymity where “[t]he district court did not explain, and we fail to see, how 
disguising plaintiffs’ identities will obstruct public scrutiny of the important issues in th[e] case’’); 
Kamehameha, 596 F.3d at 1043 (noting that, where plaintiffs brought “claims of widespread 
discrimination,” “it [wa]s difficult to see ‘how disguising plaintiffs’ identities w[ould] obstruct 
public scrutiny of the important issues in th[e] case’) (quoting Advanced Textile, 214 F.3d at 
1072). Withholding the true identities of the individual software developers who bring this case 
will not obstruct public scrutiny of the issues raised. Plaintiffs’ names and identities have no 
bearing on the central issues of this case, including whether Defendants’ AI-based coding tools 
illegally reproduce licensed code used as training data. The Court finds that the public interest 
factor does not weigh against anonymity at this stage of the litigation. See El Dorado, 2013 WL 
6230342, at *6 (finding public interest factor weighed in favor of anonymity where the 
“[p]laintiff’s identity appears to have no bearing on the resolution of the issues, and a pseudonym 
will not impede public access to the substance of the proceedings”). !” 

Balancing these factors, the Court finds that Plaintiffs may proceed pseudonymously at this 
time. 

C. Rule 8(a) 

Defendants argue that the complaint should be dismissed under Federal Rule of Civil 
Procedure 8(a) because Plaintiffs do not plead sufficient facts regarding the role of each Defendant 
in the alleged misconduct. 

A complaint must contain “a short and plain statement of the claim showing that the 
pleader is entitled to relief.” Fed. R. Civ. P. 8(a)(2). “[T]he ‘short and plain statement’ must 
provide the defendant with ‘fair notice of what the plaintiff’s claim is and the grounds upon which 
it rests.’” Dura Pharms., Inc. v. Broudo, 544 U.S. 336, 346 (2005) (quoting Conley v. Gibson, 355 
U.S. 41, 47 (1957)). To comply with Rule 8(a), a plaintiff “must allege the basis of his claim 


'2 The Court is mindful that, like the other factors, the public interest in Plaintiffs’ identities may 
change as the suit progresses. See Doe v. NFL Enters., LLC, No. C 17-00496 WHA, 2017 WL 
697420, at *2 (N.D. Cal. Feb. 22, 2017) (noting that “class members will... have a right to know 
the identity of their representative in this litigation” in later stages of the case). 
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against each defendant . . . to put defendants on sufficient notice of the allegations against them.” 
Gauvin v. Trombatore, 682 F. Supp. 1067, 1071 (N.D. Cal. 1988). 

The OpenAI Defendants argue that Plaintiffs plead claims against all six OpenAI entities 
without specifying the role or conduct of each entity, thus violating Rule 8(a). But Plaintiffs 
allege that two of the OpenAI Defendants — OpenAI, Inc. and OpenAI, L.P. — “programmed, 
trained, and maintain[]” Codex, and that OpenAI, Inc. owns and controls all of the other OpenAI 
Defendants. Compl. { 23. Plaintiffs plead additional specific facts regarding the ownership and 
control of each of the OpenAI Defendants. See, e.g., id. {24 (“‘OpenAl, L.P. is a wholly owned 
subsidiary of OpenAI, Inc. .. . [and] the OpenAI entity that co-created Copilot and offers it jointly 
with GitHub.”); id. {25 (“OpenAI GP is the general partner of OpenAI, L.P. OpenAI GP 
manages and operates the day-to-day business and affairs of OpenAI, L.P.... OpenAI GP was 
aware of the unlawful conduct alleged herein and exercised control over OpenAI, L.P.”). Such 
allegations sufficiently put each OpenAI entity on notice of the basis on which Plaintiffs allege it 
may be liable for the challenged conduct." 

Similarly, Microsoft and GitHub argue that Plaintiffs’ complaint fails to satisfy Rule 8(a) 
because Plaintiffs do not allege which specific acts taken by each Defendant violate the DMCA. 
But Plaintiffs allege facts which sufficiently provide notice of the basis on which each GitHub and 
Microsoft are sued. Microsoft is alleged to maintain an ownership interest in GitHub and OpenAI, 
L.P., which allegedly co-created Copilot. Compl. { 22 (“Microsoft owns and operates GitHub. 


Through its corporate ownership, control of the GitHub Board of Directors, active management, 


'3 The Court does not decide here whether such alleged relationships in fact provide a sufficient 
basis for liability against each of the OpenAI entities for any of the pleaded claims, because that 
issue is not presently before the Court. The function of Rule 8 in this context is to “give 
Defendants fair notice of the allegations against them,” Ketayi v. Health Enrollment Grp., 516 F. 
Supp. 3d 1092, 1120 (S.D. Cal. 2021) (citations omitted), whereas the purpose of a Rule 12(b)(6) 
motion is to “test[] the legal sufficiency of the pleadings and allow[] a court to dismiss a complaint 
upon a finding that the plaintiff has failed to state a claim upon which relief may be granted,” 
Lessin v. Ford Motor Co., 600 F. Supp. 3d 1137, 1141 (S.D. Cal. 2022) (citation omitted). See 
also Olson v. Puckett, No. 221CV01482KJMDMC, 2023 WL 2602174, at *1 (E.D. Cal. Mar. 22, 
2023) (“To the extent there is a difference between the standards imposed by Rule 8 and Rule 
12(b)(6), this court interprets the Rule 8 requirement as the lesser of the two.”). 
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and other means, Microsoft sells, markets and distributes Copilot.”); id. {7 (“Microsoft obtained a 
partial ownership interest in OpenAI.... As OpenAI’s largest investor . . . Microsoft exerts 
considerable control over OpenAI.”’); id. {24 (“OpenAI, L.P. is the OpenAI entity that co-created 
Copilot and offers it jointly with GitHub.”). Plaintiffs further allege, on information and belief, 
that “Microsoft, GitHub, [and] OpenAI. . . have worked together to create Copilot.” Jd. { 241. 
Such allegations provide sufficient notice of the basis of Plaintiffs’ DMCA claims against each 
Defendant.'* The complaint is not deficient under Rule 8(a). 

D. Rule 12(b)(6) 

Defendants move to dismiss most of Plaintiffs’ claims for failure to state a claim on which 
relief may be granted. In opposition, Plaintiffs do not address Defendants’ substantive arguments 
about the sufficiency of Plaintiffs’ claims for violation of Section 1202(a) of the DMCA, tortious 
interference, fraud, false designation of origin, or violation of the CCPA. Plaintiffs instead state 
that they “do not concede” these claims “have been inadequately pled,” but request leave to amend 
the claims. ECF No. 66 at 30; ECF No. 67 at 32 n.17. Without briefing from both parties, the 
Court will not evaluate the merits of Defendants’ arguments as to those claims. 

Mindful that leave to amend should be freely granted, the Court dismisses Plaintiffs’ 
claims for violation of Section 1202(a) of the DMCA, tortious interference, fraud, false 
designation of origin, and violation of the CCPA with leave to amend. 

1. Copyright Preemption 

Defendants argue that several of Plaintiffs’ state law claims are preempted by Section 301 
of the Copyright Act. Because most of these claims were previously dismissed, the Court only 
considers whether Plaintiffs’ unjust enrichment claim is subject to copyright preemption. 

The Copyright Act of 1976 expressly preempts state claims where the plaintiff's work 
“come[s] within the subject matter of copyright” and the state law grants “legal or equitable rights 
that are equivalent to any of the exclusive rights within the general scope of copyright.” 17 U.S.C. 


§ 301(a). The Ninth Circuit has established a two-part test to determine whether state law claims 


'4 Again, the Court does not determine whether such allegations are sufficient to plead a basis for 
liability against any Defendant. See supra note 13. 
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are preempted. First, “[the court must] decide ‘whether the “subject matter” of the state law claim 
falls within the subject matter of copyright as described in 17 U.S.C. §§ 102 and 103.’” Maloney 
v. T3Media, Inc., 853 F.3d 1004, 1010 (9th Cir. 2017). If it does, the court must “determine 
‘whether the rights asserted under state law are equivalent to the rights contained in 17 U.S.C. 

§ 106, which articulates the exclusive rights of copyright holders.’” Jd. “Ifa state law claim 
includes an ‘extra element’ that makes the right asserted qualitatively different from those 
protected under the Copyright Act, the state law is not preempted by the Copyright Act.” Altera 
Corp. v. Clear Logic, Inc., 424 F.3d 1079, 1089 (9th Cir. 2005). 

Plaintiffs’ opposition generally does not address Defendants’ preemption arguments.'° 
However, Plaintiffs do argue generally that their state law claims are qualitatively different from 
claims under the Copyright Act because they are not solely about the unauthorized reproduction of 
Plaintiffs’ code, but also the unauthorized use of such code. Plaintiffs suggest that state law tort 
claims concerning unauthorized use are not preempted by the Copyright Act, and that “Plaintiffs 
allege that Defendants, through their unauthorized use of Plaintiffs’ code to train Codex and 
Copilot, and their display of Plaintiffs’ code to others for commercial gain, violated Plaintiffs’ 
rights under state and common law.” ECF No. 66 at 18 (emphasis added). 

Plaintiffs are correct that state law tort claims concerning unauthorized use are not 
preempted by the Copyright Act. “The [exclusive] rights protected under the Copyright Act 
include the rights of reproduction, preparation of derivative works, distribution, and display.” 
Ryan vy. Editions Ltd. W., Inc., 786 F.3d 754, 760 (9th Cir. 2015) (alteration in original) (quoting 
Altera, 424 F.3d at 1089). “A state law tort claim concerning the unauthorized use of the 
software’s end-product is not within the rights protected by the federal Copyright Act.” Altera, 
424 F.3d at 1079. However, in their complaint, Plaintiffs do not allege that Defendants’ use of 


Plaintiffs’ code for training purposes violated their rights. Rather, Plaintiffs base their unjust 


'S Plaintiffs focus this part of their opposition on their breach of open-source license claims, which 
Defendants do not move to dismiss on copyright preemption grounds. ECF No. 66 at 17-18. 
Plaintiffs additionally argue that their negligence claim and UCL unlawful conduct claim based on 
violation of the DMCA are not preempted. Jd. Defendants did not move to dismiss Plaintiffs’ 
negligence claims on copyright preemption grounds, and only moved to dismiss Plaintiffs’ UCL 
claims to the extent they were based on preempted state law claims. 
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enrichment claim on Defendants’ reproduction of Plaintiffs’ code as output and Defendants’ 
preparation of derivative works, both of which are rights protected under the Copyright Act. 
Compl. {{[ 204-09 (pleading unjust enrichment claim based on profit derived from both 
reproduction and preparation of derivative works). Because the rights on which Plaintiffs base 
their unjust enrichment claim are within those protected by the federal Copyright Act, Plaintiffs’ 
unjust enrichment claim is subject to preemption. 

Plaintiffs’ claim for unjust enrichment is dismissed with leave to amend. 

2. DMCA Section 1202(b) Claim 

Because the Court previously dismissed Plaintiffs’ claim under Section 1202(a) of the 
DMCA, the Court now only considers the sufficiency of Plaintiffs’ Section 1202(b) claim. 

“Copyright law restricts the removal or alteration of copyright management information 
(“CMP”) — information such as the title, the author, the copyright owner, the terms and conditions 
for use of the work, and other identifying information set forth in a copyright notice or conveyed 
in connection with the work.” Stevens v. Corelogic, Inc., 899 F.3d 666, 671 (9th Cir. 2018). 
Section 1202(b) of the DMCA provides that one cannot, without authority, (1) “intentionally 
remove or alter any” CMI, (2) “distribute . . . [CMI] knowing that the [CMI] has been removed or 
altered,” or (3) “distribute . . . copies of works . . . knowing that [CMI] has been removed or 
altered” while “knowing, or. . . having reasonable grounds to know, that it will induce, enable, 
facilitate, or conceal” infringement. 17 U.S.C. § 1202(b). 

Plaintiffs allege that their licensed code contains CMI including copyright notices, titles, 
authors’ names, copyright owners’ names, terms and conditions for use of the code, and 
identifying numbers or symbols. Compl. { 144. Plaintiffs allege that Defendants removed or 
altered that CMI from licensed code, distributed CMI knowing CMI had been removed or altered, 
and distributed copies of the code knowing that CMI had been removed or altered, all while 
knowing and possessing reasonable grounds to know that doing so would induce infringement. Id. 
(148, 153-55, 157. 

Defendants argue that Plaintiffs have not plausibly alleged claims under Sections 


1202(b)(1) or (b)(3) because these provisions require some active conduct that removes or alters 
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CMI. Defendants argue that the complaint merely alleges “the passive non-inclusion of CMI” by 
neutral technology which excerpts code without the accompanying CMI, rather than the active 
removal of CMI from licensed code. ECF No. 50 at 22. This semantic distinction is not 
meaningful. Plaintiffs allege that the relevant CMI was affixed to their licensed code and that 
Defendants were aware that such CMI appeared repeatedly across the data used to train Codex and 
Copilot. Compl. { 92 (CMI “usually appears just before a given block of code’’); id. J 94 (“[I]n a 
blog post, GitHub noted[,] ‘In one instance, GitHub Copilot suggested starting an empty file with 
something it had even seen more than a whopping 700,000 different times during training—that 
was the GNU General Public License.’”). Defendants subsequently trained these programs to 
ignore or remove CMI and therefore stop reproducing it. Jd. J§[ 94-95 (“As GitHub explains: 
‘GitHub Copilot has changed to require a minimum file content.’ . . . Copilot no longer reproduces 
these types of CMI.... It has been altered not to.”) (emphasis in original). Defendants knew that 
these programs reproduced training data as output. /d. 790. Plaintiffs thus plead sufficient facts 
to support a reasonable inference that Defendants intentionally designed the programs to remove 
CMI from any licensed code they reproduce as output.!° 

Defendants further argue that Plaintiffs do not sufficiently plead scienter. As the Ninth 
Circuit has explained, “the mental state requirement in Section 1202(b) must have a more specific 
application than the universal possibility of encouraging infringement.” Stevens, 899 F.3d at 674. 
Stevens involved software that allegedly removed metadata from image files which the defendant 
subsequently distributed in violation of the DMCA. The Ninth Circuit affirmed the grant of 
summary judgment to the defendant because the plaintiffs had not offered any evidence that the 
removal of CMI would impair their policing of infringement. Jd. at 675. At summary judgment, 
“specific allegations as to how identifiable infringements ‘will’ be affected are necessary”; a 
plaintiff “must make an affirmative showing, such as by demonstrating a past ‘pattern of conduct’ 
or ‘modus operandi,’ that the defendant was aware or had reasonable grounds to be aware of the 


probable future impact of its actions.” Jd. at 674. 


‘6 In other words, Plaintiffs allege that Defendants designed “neutral” programs to effectuate the 
“non-inclusion” of CMI by actively removing it from Plaintiffs’ licensed code. 
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On a motion to dismiss, a plaintiff must allege sufficient facts to support the reasonable 
inference that the defendant “knew or had a reasonable basis to know that the removal or alteration 
of CMI... w[ould] aid infringement.” Harrison v. Pinterest, Inc., No. 20-cv-05290-EJD, 2022 
WL 4348460, at * 5 (N.D. Cal. Sept. 19, 2022). At the pleading stage, mental conditions 
generally need not be alleged with specificity. “Federal Rule of Civil Procedure 9(b) provides that 
‘intent, knowledge, and other conditions of a person’s mind may be alleged generally.’ Language 
in Stevens .. . does not indicate otherwise; there, the Ninth Circuit held that ‘a plaintiff bringing a 
Section 1202(b) claim must make an affirmative showing’ of scienter in the summary judgment 
context.” Logan v. Meta Platforms, Inc., --- F. Supp. 3d ---, 2022 WL 14813836, at *9 (N.D. Cal. 
Oct. 25, 2022) (emphasis in original) (internal citation omitted) (quoting Stevens, 899 F.3d at 
674); see also Izmo, Inc. v. Roadster, Inc., No. 18-cv-06092-NC, 2019 WL 13210561, at *4 (N.D. 
Cal. Mar. 26, 2019) (“Whether [the defendant] knew or should have known that its activities 
would induce or enable an infringement of [the plaintiff's] rights is more suited to summary 
judgment.”’). 

Plaintiffs allege that Defendants knew the code they used as training data for Codex and 
Copilot routinely contained CMI. Compl. { 94. Plaintiffs also allege that GitHub knew that CMI 
was important for protecting copyright interests. GitHub regularly processed DMCA takedowns, 
such that it was aware its platform was used to distribute code with removed or altered CMI in a 
manner which induced infringement. Jd. { 165-67. Plaintiffs’ allegations raise the reasonable 
inference that Defendants knew or had reasonable grounds to know that removal of CMI carried a 
substantial risk of inducing infringement. See, e.g., Schneider v. Youtube, LLC, No. 20-cv-04423- 
JD, 2022 WL 3031212, at *2 (N.D. Cal. Aug. 1, 2022) (finding plaintiffs sufficiently pleaded 
scienter where they alleged that the defendant knew files “routinely contain CMI, that CMI is 
valuable for protecting copyright holders, and that the distribution of works with missing CMI on 
[defendant’s platform] has induced . . . infringement,” supporting a “plausible inference” that 
defendant removed CMI “with knowledge that doing so carried a ‘substantial risk’ of inducing 
infringement”) (quoting Stevens, 899 F.3d at 676); Batra v. PopSugar, No. 18-cv-03752-HSG, 


2019 WL 482492, at *2 (N.D. Cal. Feb. 7, 2019) (finding plaintiffs’ allegations regarding removal 
20 


United States District Court 
Northern District of California 


— 


YAY Dn uu Ff YW WN 


Ke) 


Case 4:22-cv-06823-JST Document 95 Filed 05/11/23 Page 21 of 25 


of CMI supported a “plausible inference” that the defendant “kn[ew] that removing the CMI 
would help to conceal the alleged infringement’). 

Defendants further argue that Plaintiffs fail to plausibly allege that Defendants distribute 
CMI “knowing the [CMI] has been removed or altered” in violation of Section 1202(b)(2). 
Plaintiffs’ opposition does not directly address this argument. In the complaint, Plaintiffs allege 
that “Defendants have a business practice of asserting and/or implying that Copilot is the author of 
the Licensed Materials” and that “Defendants’ false description of the source of Copilot’s Output 
facilitated or concealed infringement by Defendants and Copilot users.” Compl. {| 158-59. 
Plaintiffs do not identity the assertions, implications, and/or false descriptions of authorship or 
source at issue, nor do they plead facts that suggest such unidentified statements could constitute 
CMI. Plaintiffs separately allege that Copilot previously “would sometimes produce [CMI]... 
[which] was not always accurate,” but that Copilot “no longer reproduces these types of CMI, 
incorrect or otherwise, on a regular basis.” Jd. 95. Plaintiffs plead no specific facts regarding 
the allegedly inaccurate CMI Copilot once produced alongside output, nor do they plead facts 
suggesting such inaccurate CMI is likely to be produced alongside their output in the future. 
Because the allegations in the complaint do not sufficiently allege the distribution of altered CMI, 
the Court finds that Plaintiffs have failed to state a claim under Section 1202(b)(2). 

The Court denies Defendants’ motions to dismiss Plaintiffs’ claim under Sections 
1202(b)(1) and 1202(b)(3). Plaintiffs’ claim under Section 1202(b)(2) is dismissed with leave to 
amend. 

cA Breach of License Claim 

Defendants argue that Plaintiffs fail to plead the existence of a contract because they do not 
indicate which licenses are at issue or which provisions Defendants allegedly breached.!” 

Under California law, breach of contract requires plaintiffs to “plead ‘the contract, 


plaintiff's performance (or excuse for nonperformance), defendant’s breach, and damage to 


'’ Defendants additionally argue that, to the extent Plaintiffs’ breach of license claim is based on 
Defendants’ training of Codex and Copilot using licensed code, it is foreclosed by GitHub’s 
Terms of Service. Because Plaintiffs’ breach of license claim is not based on such training, see 
Compl. {{{[ 180-83, this argument is irrelevant. 
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plaintiff therefrom.” Low v. LinkedIn Corp., 900 F. Supp. 2d 1010, 1028 (N.D. Cal. 2012) 
(quoting Gautier v. Gen. Tel. Co., 234 Cal. App. 2d 302, 305 (1965)). “Identifying the specific 
provision of the contract allegedly breached by the defendant does not require the plaintiff to 
attach the contract or recite the contract’s terms verbatim. Rather, the plaintiff must identify with 
specificity the contractual obligations allegedly breached by the defendant.” Williams v. Apple, 
Inc., 449 F. Supp. 3d 892, 908 (N.D. Cal. 2020) (quoting Kaar v. Wells Fargo Bank, N.A., No. C 
16-01290 WHA, 2016 WL 3068396, at *1 (N.D. Cal. June 1, 2016)). 

Plaintiffs advance claims for breach of the eleven suggested licenses GitHub presents to 
users that require (1) attribution to the owner, (2) inclusion of a copyright notice, and (3) inclusion 
of the license terms. Compl. {[ 34 n.4. Plaintiffs attach each of these licenses to the complaint. 
Plaintiffs allege that use of licensed code “‘is allowed only pursuant to the terms of the applicable 
Suggested License,” and that each such license requires that any derivative work or copy include 
attribution, a copyright notice, and the license terms. /d. {{[ 173, 34.n.4. Plaintiffs further allege 
that Codex and Copilot reproduce licensed code as output without attribution, copyright notice, or 
license terms, thereby violating the relevant provisions of each license. While Plaintiffs do not 
identify the specific subsections of each suggested license that correspond to each of these 
requirements, the Court finds that Plaintiffs have sufficiently identified “the contractual 
obligations allegedly breached,” as required to plead a breach of contract claim. Williams, 449 F. 
Supp. 3d at 908. 

Defendants’ motions to dismiss Plaintiffs’ claim for breach of license is denied. 

4. Unfair Competition 

Plaintiffs assert claims for unfair competition under the Lanham Act, the UCL, and 
California common law against GitHub and OpenAI Defendants. These claims are predicated on 
Plaintiffs’ claims for violation of the DMCA, tortious inference, false designation of origin, 
violation of the CCPA, and negligence. 

Defendants move to dismiss Plaintiffs’ UCL claims for failure to sufficiently allege 
predicate claims. To the extent the predicate claims have been dismissed, Plaintiffs’ derivative 


UCL claims must also dismissed with leave to amend. See Eidmann v. Walgreen Co., 522 F. 
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Supp. 3d 634, 647 (N.D. Cal. 2021) (“If the ‘plaintiff cannot state a claim under the predicate law . 
. . [the UCL] claim also fails.’”) (alterations in original) (quoting Hadley v. Kellogg Sales Co., 243 
F. Supp. 3d 1074, 1094 (N.D. Cal. 2017)). Plaintiffs’ UCL claims predicated upon violation of 
Sections 1202(a) and 1202(b)(2) of the DMCA, tortious interference, false designation of origin, 
violation of the CCPA, and negligence are dismissed with leave to amend. 

Plaintiffs’ UCL claims predicated on violation of Sections 1202(b)(1) and (b)(3) of the 
DMCA remain. Defendants argue that Plaintiffs fail to plead any economic injury arising from 
the predicate violation, as required for statutory standing under the UCL. To plead a cause of 
action under the UCL, a plaintiff must allege that the challenged conduct caused “some form of 
economic injury,” like “lost money or property.” Kwikset Corp. v. Super. Ct., 51 Cal. 4th 310, 
323 (2011). As the California Supreme Court explained, a plaintiff may suffer economic injury by 
“hav[ing] a present or future property interest diminished” or “be[ing] deprived of money or 
property to which he or she has a cognizable claim.” Jd. 

Plaintiffs allege that they “have suffered monetary damages” as a result of all of the 
predicate violations listed in their UCL claim. Compl. { 213. From the allegations in the 
complaint, however, the Court cannot discern how Defendants’ alleged violations of the DMCA 
have caused or will cause Plaintiffs economic injury. Plaintiffs’ opposition argues they “lost the 
value of [their] work, including their ability to receive compensation as well as the likelihood they 
would be retained or hired in the future,” and have suffered injury to their intellectual property 
rights, including “loss of value of the computer code and the value to code authors of their 
attribution rights.” ECF No. 66 at 25. However, no such injury is alleged in the complaint. 
Accordingly, Plaintiffs’ UCL claim predicated on violation of the DMCA is dismissed with leave 
to amend. 

The OpenAI Defendants also move to dismiss Plaintiffs’ claims for unfair competition 
under the Lanham Act and California common law. Plaintiffs do not address these arguments in 
opposition, and therefore abandon the claims. See Diamond S.J. Enter., Inc. v. City of San Jose, 
No. 18-cv-01353-LHK, 2018 WL 5619746, at *4 (N.D. Cal. Oct. 29, 2018) (“An opposition 


brief’s failure to address a motion to dismiss’ [s] challenges to a claim constitutes abandonment of 
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that claim.”). Plaintiffs’ claims for unfair competition under the Lanham Act and California 
common law are dismissed with leave to amend. 
S; Civil Conspiracy 

Defendants argue that Plaintiffs’ civil conspiracy claim must be dismissed because civil 
conspiracy is not a standalone cause of action. 

“Conspiracy is not a cause of action, but a legal doctrine that imposes liability on persons 
who, although not actually committing a tort themselves, share with the immediate tortfeasors a 
common plan or design in its perpetration.” Applied Equip. Corp. v. Litton Saudi Arabia Ltd., 7 
Cal. 4th 503, 510-11 (1994) (in bank); see also Acculmage Diagnostics Corp v. Terarecon, Inc., 
260 F. Supp. 2d 941, 947-48 (N.D. Cal. 2003) (dismissing standalone civil conspiracy claim with 
prejudice because “civil conspiracy is not a separate and distinct cause of action under California 
law” and explaining that any “amended [civil conspiracy] allegations . .. must be made within the 
sections of the complaint that contain plaintiffs claims for the underlying” violations). 

Because Plaintiffs cannot plead civil conspiracy as an independent cause of action, this 
claim must be dismissed with prejudice. 

6. Declaratory Relief 

Defendants move to dismiss Plaintiffs’ claim for declaratory relief, arguing that declaratory 
relief is not a standalone cause of action. Plaintiffs do not address Defendants’ arguments as to 
this claim in their opposition briefs, and therefore have abandoned the claim. See Diamond S.J., 
2018 WL 5619746, at *4. 

“[D]eclaratory relief is not a standalone claim.” Mayen v. Bank of Am. N.A., No. 14-cv- 
03757-JST, 2015 WL 179541, at *5 (N.D. Cal. Jan. 14, 2015); see also Sowinski v. Wells Fargo 
Bank, N.A., No. 11-6431-SC, 2012 WL 5904711, at *1 (N.D. Cal. Nov. 26, 2012) (dismissing 
declaratory relief claim with prejudice and noting that “Plaintiff may still seek declaratory .. . 
relief in any further pleading, provided that he asserts a claim that could give rise to such relief”). 
Because declaratory relief is not a claim, granting leave to amend would be futile. Accordingly, 


Plaintiffs’ claim for declaratory relief is dismissed with prejudice. 


24 


United States District Court 
Northern District of California 


Case 4:22-cv-06823-JST Document 95 Filed 05/11/23 Page 25 of 25 


CONCLUSION 

Defendants’ motions to dismiss are granted in part and denied in part. Plaintiffs’ claims 
for violation of Sections 1202(a) and 1202(b)(2) of the DMCA, tortious interference in a 
contractual relationship, fraud, false designation of origin, unjust enrichment, unfair competition, 
breach of the GitHub Privacy Policy and Terms of Service, violation of the CCPA, and negligence 
are dismissed with leave to amend. Plaintiffs’ claims for civil conspiracy and declaratory relief 
are dismissed with prejudice. 

Plaintiffs shall file an amended complaint within 28 days of this order. 

IT IS SO ORDERED. 
Dated: May 11, 2023 


nited States District Judge 
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